WO2017092504A1 - 一种具备硬件加解密功能的路由器及其加解密方法 - Google Patents

一种具备硬件加解密功能的路由器及其加解密方法 Download PDF

Info

Publication number
WO2017092504A1
WO2017092504A1 PCT/CN2016/101401 CN2016101401W WO2017092504A1 WO 2017092504 A1 WO2017092504 A1 WO 2017092504A1 CN 2016101401 W CN2016101401 W CN 2016101401W WO 2017092504 A1 WO2017092504 A1 WO 2017092504A1
Authority
WO
WIPO (PCT)
Prior art keywords
encryption
decryption
ciphertext
register
routing function
Prior art date
Application number
PCT/CN2016/101401
Other languages
English (en)
French (fr)
Inventor
陈学凯
Original Assignee
上海斐讯数据通信技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 上海斐讯数据通信技术有限公司 filed Critical 上海斐讯数据通信技术有限公司
Publication of WO2017092504A1 publication Critical patent/WO2017092504A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Definitions

  • the present invention relates to the field of network security technologies, and in particular, to a router and a method for encrypting/decrypting data by the router.
  • routers are important devices to ensure data security.
  • Encryption technology is the core technology and effective means to ensure data security, ensuring the security of data sent from one router to another. So encryption is essential when sending some important top secret data. If it is not encrypted, the criminals who can analyze the data stream will easily read the transmitted data or even change the data sent by others, which will easily lead to the leakage of data and bring huge losses to the user. Therefore, the use of encryption to ensure the security of the transmitted data has received extensive attention and application.
  • the router As a terminal device and an Internet interconnection device, the router is located between the untrusted network and the trusted network. It is an essential part of data forwarding. The encryption protection of data must be considered when transferring important information or important information. Although the general routers all contain embedded micro-processing units, their computing power is extremely low, which cannot meet the requirements of high-speed encryption and decryption processing of data streams.
  • the more commonly used encryption method is the software method. Although it can satisfy personal use, if it is used for high security and large data volume such as government departments and financial institutions, the shortcomings of software encryption are exposed, including Software encryption takes up a lot of host resources, software implementation is slow, programs are easy to track, key passwords are difficult to manage, virus software, especially Trojans, and backdoors threaten.
  • the present invention provides a router with hardware encryption and decryption function and a method for encrypting and decrypting the same by integrating a hardware algorithm based on a Field-Programmable Gate Array (FPGA) into a conventional On the router, the encryption and decryption of the transmitted data and high-speed forwarding are implemented.
  • FPGA Field-Programmable Gate Array
  • a router with hardware encryption and decryption function includes an interconnected routing function module and an FPGA-based hardware encryption and decryption module, and the hardware encryption and decryption module encrypts or clears the plaintext received by the routing function module from the outside world.
  • the ciphertext received from the outside is decrypted, and the routing function module sends the encrypted data encrypted by the hardware encryption and decryption module or the decrypted data generated by the decryption via a wireless channel.
  • a hardware encryption and decryption module is built in the existing router, so that the hardware encryption and decryption module is used to encrypt or decrypt the plaintext or ciphertext received by the router during the working process, not only through the software.
  • the hardware encryption and decryption module includes: an FPGA processor, a first data receiving unit, a key generator, a first register built in the FPGA processor, and a first built in the FPGA processor a configuration unit, an encryption and decryption unit, and a first data transmission unit, wherein
  • the first data receiving unit is connected to the routing function module, and the first data receiving unit is configured to receive the plaintext that needs to be encrypted sent by the routing function module or the ciphertext that needs to be decrypted, and is used for receiving the a register configuration instruction sent by the routing function module and a control instruction for receiving the key generated by the routing function module to control the key generator to generate a key;
  • the first configuration unit is configured to configure an operation mode of the first register according to the register configuration instruction
  • the key generator is connected to the FPGA processor, and the key generator generates an encryption key or a decryption key according to the control instruction under the control of the FPGA processor;
  • the encryption and decryption unit is respectively connected to the FPGA processor and the key generator, and the encryption and decryption unit adds the plaintext by using the encryption key under the control of the FPGA processor. Decrypting the ciphertext using the decryption key and buffering the generated encrypted data or decrypted data in the first register;
  • the first data sending unit is connected to the FPGA processor, and the first data sending unit converts the encrypted data or the decrypted data buffered in the first register under the control of the FPGA processor. Send to the routing function module.
  • the hardware encryption and decryption module realizes the operations of receiving, encrypting/decrypting, and transmitting the encrypted data/decrypted data under the control of the FPGA processor to achieve the object of the present invention.
  • the key generator includes: a random number generating unit, a key expanding unit, and a storage unit, where
  • the random number generating unit is connected to the FPGA processor, the random number generating unit generates a random key under the control of the FPGA processor, and sends the random key to the first register Cache;
  • the key expansion unit is respectively connected to the FPGA processor and the storage unit, and the key expansion unit reads the random key cached in the first register under the control of the FPGA processor
  • the extension generates an encryption/decryption key, and sends the encryption/decryption key to the storage unit for storage.
  • the first data receiving unit is a serial-to-parallel conversion interface
  • the first data sending unit is a parallel-to-serial conversion interface
  • the working mode of the first register is a first-in first-out mode
  • the hardware encryption and decryption module further includes an authentication unit, and the authentication unit is respectively connected to the field programmable gate array processor and the encryption and decryption unit;
  • the encryption and decryption unit uses a random key pair cached in the first register during the encryption of the ciphertext.
  • the header of the ciphertext is encrypted to generate first header encryption information; and the encryption and decryption unit uses the random key pair buffered in the first register during the encryption of the ciphertext to cache the first register.
  • the header of the ciphertext is encrypted to generate second header encryption information; the authentication unit compares the first header encryption information with the second header encryption information to implement authentication of the received ciphertext.
  • the first The ciphertext header is authenticated. Only when the identity authentication succeeds, the subsequent decryption process is entered. When the identity authentication is unsuccessful, the ciphertext is discarded.
  • the hardware encryption and decryption module is an FPGA-based Advanced Encryption Standard (AES) hardware encryption and decryption module.
  • AES Advanced Encryption Standard
  • AES encrypts and decrypts data by 128 bits, that is, 16 bytes. Each time a group of data is encrypted and decrypted, it needs to run multiple rounds.
  • the input key can be 128, 192, and 256 bits in length, that is, 16 bytes, 24 bytes, and 32 bytes. If the length of the key input by the user is not the length, it will be automatically added. These lengths. Regardless of the number of bytes of the input key, it is performed in a set of 16 bytes of data during the process of encryption and decryption. The difference in the length of the key affects the number of rounds of the encryption operation.
  • the routing function module includes: a routing micro processing unit, a second configuration unit built in the routing microprocessor, a second register built in the routing micro processing unit, and a second data receiving a unit and a second data sending unit, wherein the second data receiving unit, the second data sending unit, and the second configuration unit are respectively connected to the routing micro processing unit;
  • the routing function module receives the plaintext or ciphertext sent by the outside world through the second data receiving unit, and sends the plaintext or ciphertext to the routing microprocessing unit; Performing packet parsing on the received plaintext or ciphertext, and buffering the plaintext or ciphertext after the parsing of the packet in the second register, and finally buffering the packet in the second register Transmitting the plaintext or ciphertext to the hardware encryption and decryption module by using the second data sending unit;
  • the routing function module receives the encrypted data or the decrypted data generated by the hardware encryption and decryption module through the second data receiving unit, and performs encapsulation, and Encapsulating encrypted data or decrypted data is buffered in the second register, and finally the encapsulated encrypted data or decrypted data buffered in the second register is sent out via a wireless channel;
  • the second configuration unit is configured to configure an operation mode of the second register built in the routing micro processing unit.
  • the road The function module is actually used for forwarding data without performing encryption and decryption operations.
  • the hardware encryption and decryption module can be regarded as a small system that can work independently between the computer-side Ethernet data and the micro-processing unit in the router during the working process, and the physical isolation is very good, and is not easily affected by the outside world.
  • the second data receiving unit comprises an Ethernet data interface and/or a wireless transceiver interface; and the working mode of the second register is a first in first out mode.
  • the invention also provides a router encryption method, which is applied to the above router with hardware encryption and decryption function, and the router encryption method comprises the following steps:
  • the S100 routing function module receives the plaintext that needs to be encrypted from the outside, and sends the plaintext to the hardware encryption and decryption module;
  • the hardware encryption and decryption module of S110 encrypts the plaintext, and sends the encrypted data generated by the encryption to the routing function module;
  • the routing function module of S120 sends the encrypted data out via a wireless channel.
  • the routing function module of S101 receives the plaintext that needs to be encrypted from the outside;
  • the routing function module of S102 performs packet parsing on the received plaintext.
  • the routing function module of S103 configures an operating mode of the second register built therein;
  • the routing function module sends the plaintext, the register configuration command, and the control command after the message parsing to the hardware encryption and decryption module.
  • step S110 the following steps are specifically included:
  • the hardware encryption/decryption module of S111 receives the plaintext, register configuration instruction and control instruction after the message is parsed;
  • S112 caches the plaintext after the message parsing
  • the hardware encryption/decryption module of S113 configures an operation mode of the first register built therein according to the register configuration instruction
  • the hardware encryption and decryption module generates a random key according to the control instruction, and caches the random key in the first register;
  • the hardware encryption and decryption module of S115 expands the random key to generate an encryption key, and stores the encryption key;
  • the hardware encryption and decryption module of S116 encrypts the parsed plaintext by using the encryption key to generate encrypted data, and caches the encrypted data in the first register;
  • the hardware encryption and decryption module of S117 sends the encrypted data to the routing function module.
  • step S116 the method specifically includes:
  • S1161 obtains the total number of rounds of encryption R1;
  • S1162 initializes the current number of encryption rounds r1, and sets its initial value to 1;
  • S1163 determines whether the current number of encryption rounds r1 is greater than the total number of rounds of encryption R1, and if not, jumps to step S1163; if so, the process proceeds to step S1166;
  • S1164 performs one round of encryption on the parsed plaintext by using the encryption key
  • step S120 the following steps are specifically included:
  • the routing function module of S121 receives the encrypted data
  • the routing function module of S122 encapsulates the encrypted data
  • the routing function module of S123 sends the encapsulated encrypted data to the wireless channel.
  • the invention also provides a router decryption method, which is applied to the above router with hardware encryption and decryption function, and the router decryption method comprises the following steps:
  • the S200 routing function module receives the ciphertext that needs to be decrypted from the outside, and sends the ciphertext to the hardware encryption and decryption module;
  • the hardware encryption and decryption module of S210 decrypts the ciphertext, and sends the decrypted data generated by the decryption to the routing function module;
  • the routing function module of S220 transmits the decrypted data via a wireless channel.
  • step S200 the method specifically includes:
  • the S201 routing function module receives the ciphertext that needs to be decrypted from the outside;
  • the routing function module of S202 performs packet parsing on the received ciphertext
  • the routing function module configures an operating mode of the second register built therein;
  • the routing function module sends the message-resolved ciphertext, the register configuration instruction, and the control instruction to the hardware encryption and decryption module.
  • step S210 the following steps are specifically included:
  • the hardware encryption and decryption module of S211 receives the ciphertext, register configuration instruction and control instruction after the message parsing;
  • the hardware encryption and decryption module configures its built-in first register according to the register configuration instruction
  • the hardware encryption and decryption module of S214 authenticates the header of the ciphertext after the packet is parsed
  • the hardware encryption and decryption module generates a random key according to the control instruction, and caches the random key in the first register;
  • the hardware encryption and decryption module expands the random key to generate a decryption key, and stores the decryption key;
  • the hardware encryption and decryption module of S217 decrypts the ciphertext after the message parsing by using the decryption key to generate decrypted data, and caches the decrypted data;
  • the hardware decryption module of S218 sends the decrypted data to the routing function module.
  • step S214 the following steps are specifically included in step S214:
  • S2141 encrypts a header of the ciphertext by using a random key buffered in the first register in the process of encrypting the ciphertext to generate first header encryption information
  • S2142 encrypts a header of the ciphertext buffered in the first register by using a random key buffered in the first register during encryption of the ciphertext to generate second header encryption information;
  • S2142 compares the first header encryption information and the second header encryption information, and authenticates the ciphertext
  • step S217 the method specifically includes:
  • S2172 initializes the current number of decryption rounds r2, and initially sets it to 1;
  • S2173 determines whether the current number of decryption rounds r2 is greater than the total number of decrypted rounds R2, if not, the process goes to step S2173; if so, the process goes to step S2176;
  • S2174 performs a round of decryption on the ciphertext after the message parsing using the decryption key
  • the S2176 decryption ends.
  • step S220 the following steps are specifically included:
  • the routing function module of S221 receives the decrypted data
  • the routing function module of S222 encapsulates the decrypted data.
  • the routing function module sends the encapsulated decrypted data to the wireless channel via the wireless channel.
  • the FPGA-based hardware encryption and decryption module is integrated in a traditional router.
  • the micro-processing unit in the router is not used to encrypt or decrypt the plaintext or ciphertext received in the router.
  • the hardware encryption and decryption module is used to implement encryption and decryption. It ensures that the router performs high-speed secure hardware encryption or hardware decryption on the received plaintext or ciphertext, and at the same time ensures the high-speed and efficient forwarding of encrypted data/decrypted data by the router.
  • the hardware encryption and decryption module is regarded as a small system that can work independently between the computer-side Ethernet data and the micro-processing unit in the router, and the physical isolation is very good, and the hardware encryption and decryption module is working.
  • it is not easy to be affected by the outside world; and most of the work such as control logic, timing control, and key expansion performed in the hardware encryption and decryption module is completed in hardware, which is difficult to be tracked and cracked, thereby effectively preventing illegality.
  • the reverse cracking of molecules and so on guarantees the absolute security of encrypted data.
  • the hardware encryption and decryption module in the present invention is an FPGA-based AES hardware encryption and decryption module, which is applied to a router, which not only enables the router of the present invention to have the flexibility of encrypting or decrypting by means of software, but also has the flexibility Efficient, fast, strong physical security, low cost and short development cycle.
  • the hardware encryption and decryption module implements a round function by using a loop iterative structure in the process of encrypting and decrypting, and when the number of loop iterations reaches the total number of rounds of encryption/decryption, the encryption/decryption result is output, and the hardware addition is completed.
  • the encryption/decryption process of the decryption module Using this method, the entire process is divided It is divided into multiple levels of entities connected in tandem, so that multiple data blocks are processed at the same time in the same time period, which greatly improves the throughput of the system.
  • the router provided by the present invention can be applied to a data forwarding environment in various occasions, and is particularly suitable for a plurality of places such as a department having high confidentiality requirements for data.
  • the router can be turned into a high-secure gateway device and the like only by slightly changing the software.
  • FIG. 1 is a schematic structural diagram of a first implementation manner of a router with hardware encryption and decryption function provided in the present invention
  • FIG. 2 is a schematic structural diagram of a second implementation manner of a router with hardware encryption and decryption function provided in the present invention
  • FIG. 3 is a schematic structural diagram of a third implementation manner of a router with hardware encryption and decryption function provided in the present invention
  • FIG. 4 is a schematic structural diagram of a fourth implementation manner of a router with hardware encryption and decryption function provided in the present invention
  • FIG. 5 is a schematic structural diagram of a fifth implementation manner of a router with hardware encryption and decryption function provided in the present invention
  • FIG. 6 is a schematic flowchart of a router encryption method according to the present invention.
  • FIG. 7 is a schematic flowchart of a method for decrypting a router according to the present invention.
  • 100-router 110-routing function module, 120-hardware encryption and decryption module, 121-FPGA processor, 122-first data receiving unit, 123-key generator, 124-encryption unit, 125 first data transmitting unit , 126-authentication unit, 1231-random number generation unit, 1232-key extension unit, 1233-storage unit, 111-route micro-processing unit, 112-second data reception unit, 113-second data transmission unit.
  • FIG. 1 is a schematic structural diagram of a first embodiment of a router 100 with hardware encryption and decryption function provided by the present invention.
  • the router 100 includes interconnected routing function modules 110 and based on The hardware encryption and decryption module 120 of the FPGA.
  • the routing function module 110 receives the plaintext that needs to be encrypted from the outside or receives the ciphertext that needs to be decrypted; then, the routing function module 110 sends the received plaintext or ciphertext to the hardware encryption and decryption module 120; When the hardware encryption/decryption module 120 receives the plaintext or ciphertext sent by the routing function module 110, it encrypts or decrypts it, and sends the generated encrypted data or decrypted data to the routing function module 110. Finally, the routing function module 110 transmits the received encrypted data or the decrypted generated decrypted data via a wireless channel.
  • an FPGA-based AES hardware encryption and decryption module 120 is integrated on the basis of selecting the traditional routing function module 110 of the model MT7620n, and an FPGA chip of the type EP1C6Q240 is selected, and the Verilog HDL is implemented in the FPGA chip.
  • Hardware encryption and decryption functions are necessary to add some peripheral circuits built in the router 100 to create a new type of router 100 with high-strength data security function.
  • the encrypted plaintext is transmitted to the routing function module 110 in the router 100 via the wired Ethernet; the routing function module 110 then analyzes the data frame using the wireless IEEE802.3 protocol and passes the SPI. (Serial Peripheral Interface) bus is forwarded to the hardware encryption and decryption module 120 in the FPGA to obtain the corresponding ciphertext, and then the obtained ciphertext is forwarded to the routing function module 110; the routing function module 110 passes the IEEE802.
  • the .11 MAC protocol encapsulates the data frame and transmits it to the wireless channel through the wireless physical layer, and radiates to the signal coverage space via the antenna; and the wireless function terminal (eg, smart phone, tablet computer, etc.) can receive the ciphertext. .
  • the ciphertext that needs to be decrypted is transmitted to the routing function module 110 in the router 100 via the wired Ethernet; the routing function module 110 then uses the wireless IEEE802.3 protocol to perform data on the ciphertext.
  • the analysis of the frame is forwarded to the hardware encryption/decryption module 120 in the FPGA through the SPI bus for decryption to obtain the corresponding plaintext, and the obtained plaintext is forwarded to the routing function module 110; the routing function module 110 uses the IEEE802.11 MAC protocol for the data therein.
  • the frame After the frame is encapsulated, it is sent to the wireless channel through the wireless physical layer, and is radiated to the signal coverage space via the antenna;
  • a wireless function terminal eg, a smartphone, a tablet, etc.
  • the process of encrypting or decrypting the plaintext or ciphertext received by the router 100 is not in the routing function module in the conventional router 100. It is performed in 110 (implemented in the IEEE 802.11 MAC layer), but is encrypted or decrypted by the FPGA-based AES encryption and decryption module, and then forwarded to the routing function module 110, and then forwarded by the routing function module 110.
  • the hardware encryption and decryption module 120 includes: an FPGA processor 121, a first data receiving unit 122, and a key.
  • the module 110 is connected, the key generator 123 is connected to the FPGA processor 121, and the encryption and decryption unit 124 is respectively connected to the FPGA processor 121 and the first register, and the first data transmitting unit 125 is connected to the FPGA processor 121 and the first register, respectively.
  • the first data receiving unit 122 receives the plaintext that needs to be encrypted sent by the routing function module 110 or the ciphertext that needs to be decrypted, the register configuration instruction sent by the receiving routing function module 110, and the receiving routing function module 110 sends Control key generator 123 generates a control instruction for the key, and buffers the received plaintext/ciphertext, register configuration instruction, and control instruction in the first register; subsequently, the first configuration unit is cached in the first register
  • the register configuration instruction configures an operation mode of the first register; the key generator 123 generates an encryption key or a decryption key according to the control instruction under the control of the FPGA processor 121; then, the encryption and decryption unit 124 is under the control of the FPGA processor 121 Encrypting the plaintext using the encryption key or decrypting the ciphertext using the decryption key, and buffering the generated encrypted data or decrypted data in the first register; finally, controlling the first data transmitting unit 125 in the FPGA processor 121
  • the third embodiment is modified to obtain a third embodiment.
  • the key generator 123 includes: a random number generating unit 1231, a key expanding unit 1232, and a storage unit 1233.
  • the random number generating unit 1231 is connected to the FPGA processor 121
  • the key expanding unit 1232 is connected to the FPGA processor 121 and the storage unit 1233, respectively.
  • the FPGA processor 121 controls the random number generating unit 1231 to generate a random key, and caches the generated random key in the first In a register; subsequently, the FPGA processor 121 controls the key expansion unit 1232 to expand the random key to generate an encryption and decryption key, and sends the encryption and decryption key to the storage unit 1233 for storage, so that the encryption and decryption unit is in clear text.
  • the FPGA processor 121 controls the key expansion unit 1232 to expand the random key to generate an encryption and decryption key, and sends the encryption and decryption key to the storage unit 1233 for storage, so that the encryption and decryption unit is in clear text.
  • the stored encryption/decryption key needs to be obtained from the storage unit 1233.
  • the hardware encryption and decryption module 120 is an FPGA-based AES hardware encryption/decryption module 120, which encrypts or ciphertexts using the AES encryption and decryption module based on the attributes of the AES algorithm.
  • the random key generated by the random number generating unit 1231 needs to be expanded to obtain the required encryption/decryption key. Therefore, in the present embodiment, we have provided the key expansion unit for this purpose.
  • the AES algorithm has a data width of 128 bits (bits), a key length of 192 bits, and a corresponding number of encryption/decryption rounds of 12.
  • the fourth embodiment is modified to obtain a fourth embodiment.
  • the hardware encryption and decryption module 120 further includes a certificate respectively connected to the first register and the encryption and decryption unit 124.
  • Unit 126 the encryption and decryption unit 124 uses the random key pair ciphertext buffered in the first register during the encryption of the ciphertext.
  • the header is encrypted to generate first header encryption information; at the same time, the encryption and decryption unit 124 encrypts the header of the ciphertext buffered in the first register by using a random key buffered in the first register during the encryption of the ciphertext.
  • the second header encrypts the information; the authentication unit 126 compares the first header encrypted information with the second header encrypted information to implement authentication of the received ciphertext.
  • the subsequent decryption process is only performed when the identity authentication is successful; when the identity authentication is unsuccessful, the ciphertext is discarded.
  • the header of the received ciphertext may be authenticated in other manners, such as parity check, and may be set according to actual conditions.
  • the routing function module 110 includes: a routing micro processing unit 111, and is built in the routing micro processing unit 111. a second configuration unit, a second register built in the routing microprocessing unit 111, a second data receiving unit 112, and a second data transmitting 113 unit 112, a second data receiving unit 112, a second data transmitting 113 unit 112, and a second The configuration unit is connected to the routing microprocessing unit 111, respectively.
  • the routing function module 110 receives the plaintext or ciphertext sent by the outside world through the second data receiving unit 112, and sends it to the routing microprocessing unit 111; routing microprocessing The unit 111 parses the received plaintext or ciphertext, and caches the plaintext or ciphertext after the packet parsing in the second register, and finally clears the parsed plaintext in the second register. Or the ciphertext is sent to the hardware encryption and decryption module 120 through the second data transmission 113 unit 112.
  • the routing function module 110 receives the encrypted data or the decrypted data generated by the hardware encryption and decryption module 120 through the second data receiving unit 112, and encapsulates The encapsulated encrypted data or decrypted data is buffered in a second register, and finally the encapsulated encrypted data or decrypted data buffered in the second register is transmitted via the wireless channel.
  • the second configuration unit is configured to configure an operation mode of the second register built in the routing micro processing unit 111.
  • the second data receiving unit 112 includes an Ethernet data interface and/or a wireless transceiver interface; and the second register operates in a first-in first-out mode.
  • the encrypted plaintext is transmitted to the routing micro-processing unit 111 of the routing function module 110 in the router 100 via wired Ethernet; the routing micro-processing unit 111 then uses the wireless IEEE 802.
  • the protocol analyzes the data frame of the plaintext and then transfers it to the encryption and decryption module in the hardware encryption and decryption module 120 in the FPGA through the SPI bus to obtain the corresponding ciphertext, and then forwards the obtained ciphertext to the routing microprocessing unit.
  • the routing micro-processing unit 111 encapsulates the data frame therein by using the IEEE 802.11 MAC protocol, and then sends the data frame to the wireless channel through the wireless physical layer, and radiates to the signal coverage space via the antenna; and has a wireless function terminal (for example, a smart phone or a tablet) The computer, etc.) can receive the ciphertext.
  • the decryption process is this reverse process, and will not be described here.
  • the present invention further provides a router 100 encryption method, which is applied to the above-mentioned router 100 with hardware encryption and decryption function.
  • the router 100 encryption method includes the following steps:
  • the S100 routing function module 110 receives the plaintext that needs to be encrypted from the outside, and sends the plaintext. To the hardware encryption and decryption module 120. Specifically, in this step, it includes:
  • the S101 routing function module 110 receives the plaintext that needs to be encrypted from the outside.
  • the S102 routing function module 110 performs packet parsing on the received plaintext.
  • the S103 routing function module 110 configures the operating mode of its built-in second register.
  • the S104 routing function module 110 sends the plaintext, the register configuration command, and the control command after the message parsing to the hardware encryption/decryption module 120.
  • the S110 hardware encryption and decryption module 120 encrypts the plaintext and sends the encrypted data generated by the encryption to the routing function module 110. Specifically, in this step, the following steps are included:
  • the S111 hardware encryption/decryption module 120 receives the plaintext, the register configuration instruction, and the control instruction after the message is parsed.
  • S112 caches the plaintext after the message is parsed.
  • the S113 hardware encryption/decryption module 120 configures the operating mode of its built-in first register according to the register configuration instruction.
  • the S114 hardware encryption/decryption module 120 generates a random key according to the control instruction, and caches the random key in the first register.
  • the S115 hardware encryption/decryption module 120 expands the random key to generate an encryption key, and stores the encryption key.
  • the S116 hardware encryption/decryption module 120 encrypts the plaintext after the message parsing using the encryption key to generate encrypted data, and caches the encrypted data in the first register. Further, in this step, the specific includes:
  • S1161 obtains the total number of rounds of encryption R1;
  • S1162 initializes the current number of encryption rounds r1, and sets its initial value to 1;
  • S1163 determines whether the current number of encryption rounds r1 is greater than the total number of rounds of encryption R1, and if not, jumps to step S1163; if so, the process proceeds to step S1166;
  • the S1164 encrypts the plaintext after the packet is parsed by using an encryption key.
  • the S117 hardware encryption and decryption module 120 sends the encrypted data to the routing function module 110.
  • the S120 routing function module 110 transmits the encrypted data via the wireless channel. Specifically, in this step, the following steps are specifically included:
  • the S121 routing function module 110 receives the encrypted data.
  • the S122 routing function module 110 encapsulates the data frame in the encrypted data.
  • the S123 routing function module 110 transmits the encapsulated encrypted data via the wireless channel.
  • the first register specifically includes two registers, namely, register 1 and register 2:
  • the router 100 is powered up to initialize the router 100 device, and the routing micro-processing unit 111 in the routing function module 110 configures its built-in second register to a first-in first-out mode.
  • the router 100 receives the plaintext that needs to be encrypted by means of Ethernet or wireless, and the routing micro-processing unit 111 in the routing function module 110 parses the received plaintext and caches the parsed plaintext in the first register. Then, the plaintext that has been parsed by the message is sent to the hardware encryption/decryption module 120.
  • the FPGA processor 121 in the hardware encryption and decryption module 120 buffers the received plaintext in the first register (register 1); at the same time, controls the random number generating unit to generate a random key and caches it in the built-in first register (register) 2); then the generated random key is extended to generate an encryption key (in this process, register 2 is set to 0, and the random key is sent to the key expansion unit 1232); then, the hardware encryption and decryption module 120
  • the encryption and decryption unit 124 encrypts the received plaintext using an encryption key.
  • the total number of rounds of encryption R1 is first obtained, and then the plaintext is set based on the total number of rounds of encryption (in this process, register 1 is set to 1, and the plaintext stored in the first register is stored.
  • the transmission to the encryption/decryption unit 124 is performed for one round of encryption until the number of encrypted rounds reaches the total number of rounds of encryption R1, and the encryption of the plaintext is completed to generate encrypted data and buffered.
  • the encrypted data feedback loop is received by the micro processing unit 111; after receiving the encrypted data, the routing micro processing unit 111 encapsulates the encrypted data and transmits it via the wireless channel.
  • the AES algorithm has a data width of 128 bits (bits), a key length of 192 bits, and a corresponding encryption/decryption round number of 12 (the total number of rounds of encryption R1), that is, 12 rounds of plaintext encryption. Cipher text.
  • the present invention further provides a method for decrypting a router 100, which is applied to the router 100 having the hardware encryption and decryption function, and the method for decrypting the router 100 includes the following steps:
  • the S200 routing function module 110 receives the ciphertext that needs to be decrypted from the outside, and sends the ciphertext to the hardware encryption and decryption module 120. Specifically, similar to the encryption method of the router 100, in this step, the following steps are included:
  • the S201 routing function module 110 receives the ciphertext that needs to be decrypted from the outside.
  • the S202 routing function module 110 performs packet parsing on the received ciphertext.
  • the S203 routing function module 110 configures the operating mode of the second register built therein.
  • the S204 routing function module 110 sends the ciphertext, the register configuration command, and the control command after the message parsing to the hardware encryption/decryption module 120.
  • the S210 hardware encryption/decryption module 120 decrypts the ciphertext and sends the decrypted data generated by the decryption to the routing function module 110. Specifically, similar to the encryption method of the router 100, in this step, the following steps are included:
  • the S211 hardware encryption/decryption module 120 receives the ciphertext, the register configuration instruction, and the control instruction after the message is parsed.
  • S212 caches the ciphertext after the packet is parsed.
  • the S213 hardware encryption/decryption module 120 configures its built-in first register according to the register configuration instruction.
  • the S214 hardware encryption/decryption module 120 authenticates the header of the ciphertext after the packet is parsed. Specifically include:
  • S2141 encrypts the header of the ciphertext by using a random key buffered in the first register in the process of encrypting the ciphertext to generate first header encryption information
  • S2142 encrypts a header of the ciphertext buffered in the first register by using a random key buffered in the first register during the encryption of the ciphertext to generate second header encryption information;
  • S2142 compares the first header encryption information and the second header encryption information to authenticate the ciphertext
  • the S215 hardware encryption/decryption module 120 generates a random key according to the control instruction, and caches the random key in the first register.
  • the S216 hardware encryption/decryption module 120 expands the random key to generate a decryption key and stores the decryption key.
  • the S217 hardware encryption/decryption module 120 decrypts the ciphertext after the message parsing using the decryption key to generate decrypted data, and caches the decrypted data. Specifically include:
  • S2172 initializes the current number of decryption rounds r2, and initially sets it to 1;
  • S2173 determines whether the current number of decryption rounds r2 is greater than the total number of decrypted rounds R2, if not, the process goes to step S2173; if so, the process goes to step S2176;
  • S2174 performs a round of decryption on the ciphertext after the message parsing using the decryption key
  • the S2176 decryption ends.
  • the S218 hardware decryption module sends the decrypted data to the routing function module 110.
  • the S220 routing function module 110 transmits the decrypted data via the wireless channel.
  • the following steps are specifically included:
  • the S221 routing function module 110 receives the decrypted data.
  • the S222 routing function module 110 encapsulates the decrypted data.
  • the S223 routing function module 110 transmits the encapsulated decrypted data via the wireless channel.
  • the first register specifically includes two registers, namely, register 1 and register 2:
  • the router 100 is powered up to initialize the router 100 device, and the routing micro-processing unit 111 in the routing function module 110 configures its built-in second register to a first-in first-out mode.
  • the router 100 receives the ciphertext that needs to be decrypted by means of Ethernet or wirelessly, and the routing micro-processing unit 111 in the routing function module 110 parses the received ciphertext and caches the parsed ciphertext. In the first register, the ciphertext that has been parsed by the message is sent to the hardware encryption and decryption module 120.
  • the FPGA processor 121 in the hardware encryption and decryption module 120 caches the received ciphertext in the first register (register 1); and first recognizes the ciphertext header before decrypting the ciphertext certificate.
  • the ciphertext header is encrypted by using a random key buffered in the first register (register 2) during the process of encrypting the ciphertext to generate first header encryption information;
  • the random key buffered in the first register (register 2) during the ciphertext process encrypts the header of the ciphertext buffered in the first register (register 1) to generate second header encryption information; and then, the first comparison
  • the header encryption information and the second header encryption information are used to authenticate the ciphertext; if the comparison is successful, the authentication succeeds and the decryption process is entered; on the contrary, if the comparison fails, the authentication fails, and the ciphertext is discarded.
  • the FPGA processor 121 controls the random number generating unit to generate a random key and caches it in the built-in first register (register 2); then expands the generated random key to generate a decryption key (in the process
  • the first register (register 2) is set to 0, and the random key is sent to the key expansion unit 1232); then, the encryption and decryption unit 124 in the hardware encryption and decryption module 120 uses the decryption key according to the received ciphertext. Decrypt.
  • the total number of decrypted rounds R2 is obtained, and then the ciphertext is set based on the total number of rounds of decryption (in the process, the first register (register 1) is set to 0, which will be
  • the ciphertext stored in a register is sent to the encryption/decryption unit 124 for one round of decryption until the number of decrypted rounds reaches the total number of decrypted rounds R2, and the decryption of the ciphertext is completed to generate decrypted data and buffered.
  • the decrypted data feedback loop is received by the micro processing unit 111; after receiving the decrypted data, the routing microprocessing unit 111 encapsulates the decrypted data and transmits it via the wireless channel.
  • the AES algorithm has a data width of 128 bits (bits), a key length of 192 bits, and a corresponding encryption/decryption round number of 12 (the total number of rounds of encryption is R2), that is, 12 rounds of decryption of the ciphertext. Get the plain text.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明提供了一种具备硬件加解密功能的路由器及其加解密方法，在该路由器中，包括相互连接的路由功能模块和基于现场可编程门阵列的硬件加解密模块，硬件加解密模块对路由功能模块从外界接收的明文进行加密或对路由功能模块从外界接收的密文进行解密，且路由功能模块将硬件加解密模块加密生成的加密数据或解密生成的解密数据经由无线信道发送出去。在工作过程中，不使用路由器中自身中的路由功能模块对路由器中接收到的明文或密文进行加密或解密，而是使用该硬件加解密模块实现加解密。从而保证了路由器对接收到的明文或密文进行高速安全硬件加密，同时保证了路由器对加密数据/解密数据的高速有效地转发等。

Description

一种具备硬件加解密功能的路由器及其加解密方法
本申请要求2015年12月03日提交的申请号为：201510881396.X、发明名称为“一种具备硬件加解密功能的路由器及其加解密方法”的中国专利申请的优先权，其全部内容合并在此。
技术领域
本发明涉及网络安全技术领域，尤其涉及一种路由器及该路由器对数据进行加密/解密的方法。
背景技术
在网络安全方面，路由器是保证数据安全的重要设备，而加密技术是保证数据安全的核心技术和有效手段，可保证数据从一个路由器发送到另一个路由器的安全性。所以在发送一些重要的绝密数据时，加密是必不可少的。如果不加密，能够分析数据流的不法分子会轻而易举的读取传输的数据甚至改变别人发送的数据，极容易造成数据的泄露，给用户带来巨大的损失。故，使用加密手段来保证传输数据的安全性受到了广泛的关注和应用。
路由器作为终端设备和英特网互连设备，位于不可信任网络和可信任网络之间，是数据转发的必经环节，在重要的场所或者转送重要信息时必须考虑对数据的加密保护。虽然一般的路由器都含有嵌入式微处理单元，但其运算能力极低，不能满足高速率对数据流进行加解密处理的要求。
另外，目前，较为常用的加密方式为软件方式，虽然其能够满足个人使用，但若用于政府部门、金融机构等高安全性、大数据量的情况下，软件加密的缺点就暴露出来，包括：软件加密要占用较多主机资源、软件实现速度慢、程序的运行容易被跟踪、密钥口令不易管理、病毒软件特别是木马程序后门程序带来威胁等等。
发明内容
针对上述问题，本发明提供了一种具备硬件加解密功能的路由器及其加解密方法，其通过在将基于现场可编程门阵列(Field－Programmable Gate Array，以下简称FPGA)的硬件算法集成在传统的路由器上，实现对传输数据的加解密和高速转发。
本发明提供的技术方案如下：
一种具备硬件加解密功能的路由器，包括相互连接的路由功能模块和基于FPGA的硬件加解密模块，所述硬件加解密模块对所述路由功能模块从外界接收的明文进行加密或对路由功能模块从外界接收的密文进行解密，且所述路由功能模块将所述硬件加解密模块加密生成的加密数据或解密生成的解密数据经由无线信道发送出去。
在本技术方案中，在现有的路由器中内置硬件加解密模块，这样，在工作过程中使用该硬件加解密模块对路由器接收到的明文或者密文进行加密或者解密，不但具备通过软件的方式实现加密或解密的灵活性，同时具备高效、快速、强物理安全性、成本低和开发周期短等众多优点。
进一步优选地，所述硬件加解密模块中包括：FPGA处理器、第一数据接收单元、密钥生成器、内置于所述FPGA处理器的第一寄存器、内置于所述FPGA处理器的第一配置单元、加解密单元以及第一数据发送单元，其中，
所述第一数据接收单元，与所述路由功能模块连接，所述第一数据接收单元用于接收所述路由功能模块发送的需要进行加密的明文或需要进行解密的密文、用于接收所述路由功能模块发送的寄存器配置指令以及用于接收所述路由功能模块发送的控制所述密钥生成器产生密钥的控制指令；
所述第一配置单元，用于根据所述寄存器配置指令配置所述第一寄存器的工作模式；
所述密钥生成器，与所述FPGA处理器连接，所述密钥生成器在所述FPGA处理器的控制下根据所述控制指令生成加密密钥或解密密钥；
所述加解密单元，分别与所述FPGA处理器和所述密钥生成器连接，所述加解密单元在所述FPGA处理器的控制下使用所述加密密钥对所述明文进行加 密或使用所述解密密钥对所述密文进行解密，并将生成的加密数据或解密数据缓存在所述第一寄存器中；
所述第一数据发送单元，与所述FPGA处理器连接，所述第一数据发送单元在所述FPGA处理器的控制下将所述第一寄存器中缓存的所述加密数据或所述解密数据发送至所述路由功能模块。
在本技术方案中，硬件加解密模块在FPGA处理器的控制下实现明文/密文的接收、加密/解密以及加密数据/解密数据的发送等操作，实现本发明的目的。
进一步优选地，所述密钥生成器中包括：随机数发生单元、密钥扩展单元以及存储单元，其中，
所述随机数发生单元，与所述FPGA处理器连接，所述随机数发生单元在所述FPGA处理器的控制下产生随机密钥，并将所述随机密钥发送至所述第一寄存器中进行缓存；
所述密钥扩展单元，分别与所述FPGA处理器和所述存储单元连接，所述密钥扩展单元在所述FPGA处理器的控制下对所述第一寄存器中缓存的所述随机密钥进行扩展生成加解密密钥，并将所述加解密密钥发送至所述存储单元中进行存储。
进一步优选地，所述第一数据接收单元为一串并转换接口，所述第一数据发送单元为一并串转换接口；所述第一寄存器的工作模式为先进先出模式。
进一步优选地，所述硬件加解密模块中还包括一认证单元，所述认证单元分别与现场可编程门阵列处理器和所述加解密单元连接；
当所述硬件加解密模块接收到所述路由功能模块发送的需要进行解密的密文时，所述加解密单元使用加密该密文过程中缓存在所述第一寄存器中的随机密钥对所述密文的报头进行加密生成第一报头加密信息；同时所述加解密单元使用加密该密文过程中缓存在所述第一寄存器中的随机密钥对缓存在所述第一寄存器中的该密文的报头进行加密生成第二报头加密信息；所述认证单元将所述第一报头加密信息和所述第二报头加密信息进行比对，实现接收的所述密文的认证。
在本技术方案中，在硬件加解密模块中，在对密文进行解密之前，首先要 对该密文的报头进行身份认证，只有当身份认证成功了，才会进入后续的解密程序；当身份认证不成功，会将该密文进行丢弃处理。
进一步优选地，所述硬件加解密模块为基于FPGA的高级加密标准(Advanced Encryption Standard，以下简称AES)硬件加解密模块。
AES是对数据按128位，也就是16个字节进行分组进行加解密的，每次对一组数据加解密需要运行多轮。而输入密钥的长度可以为128、192和256位，也就是16个字节、24个字节和32个字节，如果用户输入的密钥长度不是这几种长度，则会自动补成这几种长度。无论输入密钥是多少字节，在加解密的过程中还是以16字节的数据一组来进行的，密钥长度的不同影响加密运行的轮数。
进一步优选地，所述路由功能模块中包括：路由微处理单元、内置于所述路由微处理器中的第二配置单元、内置在所述路由微处理单元中的第二寄存器、第二数据接收单元以及第二数据发送单元，所述第二数据接收单元、所述第二数据发送单元和所述第二配置单元分别与所述路由微处理单元连接；
在接收明文或密文的过程中：所述路由功能模块通过所述第二数据接收单元接收外界发送的明文或密文，并将其发送至所述路由微处理单元；所述路由微处理单元对接收到的所述明文或密文进行报文解析，并将经过报文解析后的明文或密文缓存在所述第二寄存器中，最后将缓存在所述第二寄存器中的经过报文解析后的明文或密文通过所述第二数据发送单元发送至所述硬件加解密模块；
在发送经过加解密生成的加密数据或解密数据的过程中：所述路由功能模块通过所述第二数据接收单元接收所述硬件加解密模块生成的加密数据或解密数据并进行封装，并将经过封装的加密数据或解密数据缓存在所述第二寄存器中，最后将缓存在所述第二寄存器中的封装后的加密数据或解密数据经由无线信道发送出去；
所述第二配置单元，用于配置所述路由微处理单元中内置第二寄存器的工作模式。
在本技术方案中可以看出，在对明文或密文进行加密或解密的过程中，路 由功能模块实际上用于数据的转发，而不进行加解密的操作。且硬件加解密模块在工作过程中可以看作一个处于电脑端以太网数据和路由器中微处理单元之间可以独自工作的一个小系统，物理隔绝性非常好，不易受到外界的影响。
进一步优选地，所述第二数据接收单元包括以太网数据接口和/或无线收发接口；所述第二寄存器的工作模式为先进先出模式。
本发明还提供了一种路由器加密方法，应用于上述具备硬件加解密功能的路由器，所述路由器加密方法包括以下步骤：
S100路由功能模块从外界接收需要进行加密的明文，并将所述明文发送至所述硬件加解密模块；
S110所述硬件加解密模块对所述明文进行加密，并将加密生成的加密数据发送至所述路由功能模块；
S120所述路由功能模块将所述加密数据经由无线信道发送出去。
进一步优选地，在步骤S100中，具体包括：
S101所述路由功能模块从外界接收需要进行加密的明文；
S102所述路由功能模块对接收到的所述明文进行报文解析；
S103所述路由功能模块对其内置的第二寄存器的工作模式进行配置；
S104所述路由功能模块将经过报文解析后的明文、寄存器配置指令以及控制指令发送至所述硬件加解密模块。
进一步优选地，在步骤S110中，具体包括以下步骤：
S111所述硬件加解密模块接收所述经过报文解析后的明文、寄存器配置指令以及控制指令；
S112缓存所述经过报文解析后的明文；
S113所述硬件加解密模块根据所述寄存器配置指令配置其内置的第一寄存器的工作模式；
S114所述硬件加解密模块根据所述控制指令生成随机密钥，并将所述随机密钥缓存在所述第一寄存器中；
S115所述硬件加解密模块对所述随机密钥进行扩展生成加密密钥，并将所述加密密钥进行存储；
S116所述硬件加解密模块使用所述加密密钥对所述经过报文解析后的明文进行加密生成加密数据，并将所述加密数据缓存在所述第一寄存器中；
S117所述硬件加解密模块将所述加密数据发送至所述路由功能模块。
进一步优选地，在步骤S116中，具体包括：
S1161获取加密总轮数R1；
S1162初始化当前加密轮数r1，将其初始值设定为1；
S1163判断当前加密轮数r1是否大于加密总轮数R1，若不是，跳转至步骤S1163；若是，跳转至步骤S1166；
S1164使用所述加密密钥对所述经过报文解析后的明文进行一轮加密；
S1165将r1＝r1+1生成新的当前加密轮数，跳转至步骤S1163；
S1166加密结束。
进一步优选地，在步骤S120中，具体包括以下步骤：
S121所述路由功能模块接收所述加密数据；
S122所述路由功能模块对所述加密数据进行封装；
S123所述路由功能模块将封装后的加密数据经由无线信道发送出去。
本发明还提供了一种路由器解密方法，应用于上述具备硬件加解密功能的路由器，所述路由器解密方法包括以下步骤：
S200路由功能模块从外界接收需要进行解密的密文，并将所述密文发送至所述硬件加解密模块；
S210所述硬件加解密模块对所述密文进行解密，并将解密生成的解密数据发送至所述路由功能模块；
S220所述路由功能模块将所述解密数据经由无线信道发送出去。
进一步优选地，在步骤S200中，具体包括：
S201路由功能模块从外界接收需要进行解密的密文；
S202所述路由功能模块对接收到的所述密文进行报文解析；
S203所述路由功能模块对其内置的第二寄存器的工作模式进行配置；
S204所述路由功能模块将经过报文解析后的密文、寄存器配置指令以及控制指令发送至所述硬件加解密模块。
进一步优选地，在步骤S210中，具体包括以下步骤：
S211所述硬件加解密模块接收所述经过报文解析后的密文、寄存器配置指令以及控制指令；
S212缓存所述经过报文解析后的密文；
S213所述硬件加解密模块根据所述寄存器配置指令配置其内置的第一寄存器；
S214所述硬件加解密模块对所述经过报文解析后的密文的报头进行认证；
S215所述硬件加解密模块根据所述控制指令生成随机密钥，并将所述随机密钥缓存在所述第一寄存器中；
S216所述硬件加解密模块对所述随机密钥进行扩展生成解密密钥，并存储所述解密密钥；
S217所述硬件加解密模块使用所述解密密钥对所述经过报文解析后的密文进行解密生成解密数据，并缓存所述解密数据；
S218所述硬件解密模块将所述解密数据发送至所述路由功能模块。
进一步优选地，在步骤S214中具体包括以下步骤：
S2141使用加密该密文的过程中缓存在第一寄存器中的随机密钥对所述密文的报头进行加密生成第一报头加密信息；
S2142使用加密该密文过程中缓存在所述第一寄存器中的随机密钥对缓存在所述第一寄存器中的该密文的报头进行加密生成第二报头加密信息；
S2142比对所述第一报头加密信息和所述第二报头加密信息，对所述密文进行认证；
S2143若认证成功，跳转至步骤S215。
进一步优选地，在步骤S217中，具体包括：
S2171获取解密总轮数R2；
S2172初始化当前解密轮数r2，将其初始设定为1；
S2173判断当前解密轮数r2是否大于解密总轮数R2，若不是，跳转至步骤S2173；若是，跳转至步骤S2176；
S2174使用所述解密密钥对所述经过报文解析后的密文进行一轮解密；
S2175将r＝r+1生成新的当前解密轮数，并跳转至步骤S1163；
S2176解密结束。
进一步优选地，在步骤S220中，具体包括以下步骤：
S221所述路由功能模块接收所述解密数据；
S222所述路由功能模块对所述解密数据进行封装；
S223所述路由功能模块将封装后的解密数据经由无线信道发送出去。
本发明提供的具备硬件加解密功能的路由器及其加解密方法，能够带来以下有益效果：
在本发明中，将基于FPGA的硬件加解密模块集成在传统路由器中，在工作过程中，不使用路由器中自身中的微处理单元对路由器中接收到的明文或密文进行加密或解密，而是使用该硬件加解密模块实现加解密。保证了路由器对接收到的明文或密文进行高速安全硬件加密或硬件解密，同时保证了路由器对加密数据/解密数据的高速有效地转发等。
再有，在本发明中，将硬件加解密模块看作一个处于电脑端以太网数据和路由器中微处理单元之间可以独自工作的一个小系统，物理隔绝性非常好，硬件加解密模块在工作过程中不易受到外界的影响；且在硬件加解密模块中进行的控制逻辑、时序控制、密钥扩展等绝大部分工作都在硬件中完成，难以被跟踪和被破解，进而能够有效地防止不法分子的逆向破解等等，保障了加密数据的绝对安全。
再有，本发明中的硬件加解密模块为基于FPGA的AES硬件加解密模块，将其应用在路由器中，不但使本发明中的路由器具备通过软件的方式实现加密或解密的灵活性，同时具备高效、快速、强物理安全性、成本低和开发周期短等众多优点。
再有，在本发明中，硬件加解密模块在进行加解密的过程中，采用循环迭代结构实现轮函数，当循环迭代的次数达到加密/解密总轮数，输出加密/解密结果，完成硬件加解密模块的加密/解密过程。采用这种方法，将整个过程分划 分为前后相连的多级实体，这样同一时间段内有多个数据块同时在各级中处理，进而大大提高了系统的吞吐量。
最后，本发明提供的路由器可适用于各种场合的数据转发环境，尤其适用于对数据有很高保密要求的部门等众多场所。在本发明的硬件基础上只需要把软件稍加更改就可以使这款路由器变成一个高保密的网关设备等等。
附图说明
下面将以明确易懂的方式，结合附图说明优选实施方式，对上述特性、技术特征、优点及其实现方式予以进一步说明。
图1为本发明中提供的具备硬件加解密功能的路由器的第一种实施方式的结构示意图；
图2为本发明中提供的具备硬件加解密功能的路由器的第二种实施方式的结构示意图；
图3为本发明中提供的具备硬件加解密功能的路由器的第三种实施方式的结构示意图；
图4为本发明中提供的具备硬件加解密功能的路由器的第四种实施方式的结构示意图；
图5为本发明中提供的具备硬件加解密功能的路由器的第五种实施方式的结构示意图；
图6为本发明中路由器加密方法流程示意图；
图7为本发明中路由器解密方法流程示意图。
附图标号说明：
100-路由器，110-路由功能模块，120-硬件加解密模块，121-FPGA处理器，122-第一数据接收单元，123-密钥生成器，124-加解密单元，125第一数据发送单元，126-认证单元，1231-随机数发生单元，1232-密钥扩展单元，1233-存储单元，111-路由微处理单元，112-第二数据接收单元，113-第二数据发送单元。
具体实施方式
如图1所示为本发明提供的具备硬件加解密功能的路由器100的第一种实施方式的结构示意图，从图中可以看出，在该路由器100中包括相互连接的路由功能模块110和基于FPGA的硬件加解密模块120。在工作过程中，首先，路由功能模块110从外界接收需要进行加密的明文或接收需要进行解密的密文；随后，路由功能模块110将接收到的明文或密文发送至硬件加解密模块120；硬件加解密模块120接收到了路由功能模块110发送的明文或密文时，随即对其进行加密或解密，并将生产的加密数据或解密数据发送至所述路由功能模块110；最后，路由功能模块110将接收到的加密数据或解密生成的解密数据经由无线信道发送出去。
在一个具体实施例中，在选择型号为MT7620n的传统路由功能模块110的基础上集成基于FPGA的AES硬件加解密模块120，且选用型号为EP1C6Q240的FPGA芯片，在该FPGA芯片中使用Verilog HDL实现硬件加解密的功能。当然，在该实施例中还需要附加一些外围电路内置在该路由器100中，制作成具有高强度数据保密功能的新型路由器100。以下以硬件加解密模块120为AES硬件加解密模块120为例：
在加密过程中，首先，需要进行加密的明文经有线以太网传输到路由器100中的路由功能模块110中；路由功能模块110随即使用无线IEEE802.3协议对该明文进行数据帧的分析后通过SPI(Serial Peripheral Interface，串行外设接口)总线转送到FPGA中的硬件加解密模块120中进行加密得到相应的密文，再将得到的密文转发给路由功能模块110；路由功能模块110通过IEEE802.11MAC协议对其中的数据帧进行封装之后通过无线物理层发送到无线信道之中，经天线辐射到信号覆盖空间；具备无线功能终端(如，智能手机、平板电脑等)就能接收该密文。相对应地，在解密过程中，首先，需要进行解密的密文经有线以太网传输到路由器100中的路由功能模块110中；路由功能模块110随即使用无线IEEE802.3协议对该密文进行数据帧的分析后通过SPI总线转送到FPGA中的硬件加解密模块120中进行解密得到相应的明文，再将得到的明文转发给路由功能模块110；路由功能模块110通过IEEE802.11MAC协议对其中的数据帧进行封装之后通过无线物理层发送到无线信道之中，经天线辐射到信号覆盖空间；具 备无线功能终端(如，智能手机、平板电脑等)就能接收该明文。
从上述对具体实施例中加密过程和解密过程的描述中可以看出，在本实施方式中，对路由器100接收到的明文或密文进行加密或解密的过程不在传统路由器100中的路由功能模块110(IEEE 802.11MAC层内部实现)中进行，而是通过基于FPGA的AES加解密模块对其进行加密或解密之后转发到路由功能模块110，再由路由功能模块110进行转发即可。
对上述第一种实施方式进行改进得到第二种实施方式，如图2所示，在本实施方式中，硬件加解密模块120中包括：FPGA处理器121、第一数据接收单元122、密钥生成器123、内置于FPGA处理器121的第一寄存器、内置于FPGA处理器121的第一配置单元、加解密单元124以及第一数据发送单元125，其中，第一数据接收单元122与路由功能模块110连接，密钥生成器123与FPGA处理器121连接，加解密单元124分别与FPGA处理器121和第一寄存器连接，第一数据发送单元125分别与FPGA处理器121和第一寄存器连接。在工作过程中，首先，第一数据接收单元122接收路由功能模块110发送的需要进行加密的明文或需要进行解密的密文、接收路由功能模块110发送的寄存器配置指令以及接收路由功能模块110发送的控制密钥生成器123产生密钥的控制指令，且将接收到的明文/密文、寄存器配置指令和控制指令分别缓存在第一寄存器中；随后，第一配置单元第一寄存器中缓存的寄存器配置指令配置第一寄存器的工作模式；密钥生成器123在FPGA处理器121的控制下根据控制指令生成加密密钥或解密密钥；接着，加解密单元124在FPGA处理器121的控制下使用加密密钥对明文进行加密或使用解密密钥对密文进行解密，并将生成的加密数据或解密数据缓存在第一寄存器中；最后，第一数据发送单元125在FPGA处理器121的控制下将第一寄存器中缓存的加密数据或解密数据发送至路由功能模块110。在一个具体实施例中，上述第一数据接收单元122为一串并转换接口、第一数据发送单元125为一并串转换接口；第一寄存器的工作模式为先进先出模式。
对上述第二实施方式进行改进得到第三种实施方式，如图3所示，密钥生成器123中包括：随机数发生单元1231、密钥扩展单元1232以及存储单元1233， 其中，随机数发生单元1231与FPGA处理器121连接，密钥扩展单元1232分别与FPGA处理器121和存储单元1233连接。在工作的过程中，当硬件加解密模块120接收到路由功能模块110发送的控制指令之后，FPGA处理器121随即控制随机数发生单元1231产生随机密钥，并将生成的随机密钥缓存在第一寄存器中；随后，FPGA处理器121控制密钥扩展单元1232对随机密钥进行扩展生成加解密密钥，并将加解密密钥发送至存储单元1233中进行存储，这样加解密单元在对明文/密文进行加密/解密的过程中只需要从存储单元1233中获取存储的加解密密钥即可。由第一种实施方式中我们知道，硬件加解密模块120为基于FPGA的AES硬件加解密模块120，基于AES算法的属性，在使用AES加解密模块对明文进行加密或对密文进行解密的过程中，需要对随机数发生单元1231生成的随机密钥进行扩展得到需要的加解密密钥，故在本实施方式中，我们设置了密钥扩展单元实现这一目的。在一个具体实施例中，上述AES算法数据宽度为128bit(比特)，密钥长度为192bit，相对应的加密/解密轮数为12。
对上述第三种实施方式进行改进得到第四种实施方式，如图4所示，在本实施方式中，硬件加解密模块120中还包括一分别与第一寄存器以及加解密单元124连接的认证单元126。具体来说，当硬件加解密模块120接收到路由功能模块110发送的需要进行解密的密文时，加解密单元124使用加密该密文过程中缓存在第一寄存器中的随机密钥对密文的报头进行加密生成第一报头加密信息；同时加解密单元124使用加密该密文过程中缓存在第一寄存器中的随机密钥对缓存在第一寄存器中的该密文的报头进行加密生成第二报头加密信息；认证单元126将第一报头加密信息和第二报头加密信息进行比对，实现接收的密文的认证。在该过程中，只有当身份认证成功了，才会进入后续的解密程序；当身份认证不成功，会将该密文进行丢弃处理。当然，在其他实施例中还可以采用其他的方式对接收到密文的报头进行认证，如奇偶校验等，可以根据实际情况进行设定。
对上述第四种实施方式进行改进得到第五种实施方式，如图5所示，路由功能模块110中包括：路由微处理单元111、内置在路由微处理单元111中的 第二配置单元、内置在路由微处理单元111中的第二寄存器、第二数据接收单元112以及第二数据发送113单元112，第二数据接收单元112、第二数据发送113单元112和第二配置单元分别与路由微处理单元111连接。在该实施方式中，在接收明文或密文的过程中：路由功能模块110通过第二数据接收单元112接收外界发送的明文或密文，并将其发送至路由微处理单元111；路由微处理单元111对接收到的明文或密文进行报文解析，并将经过报文解析后的明文或密文缓存在第二寄存器中，最后将缓存在第二寄存器中的经过报文解析后的明文或密文通过第二数据发送113单元112发送至硬件加解密模块120。相对应地，在发送经过加解密生成的加密数据或解密数据的过程中：路由功能模块110通过第二数据接收单元112接收硬件加解密模块120生成的加密数据或解密数据并进行封装，并将经过封装的加密数据或解密数据缓存在第二寄存器中，最后将缓存在第二寄存器中的封装后的加密数据或解密数据经由无线信道发送出去。第二配置单元，用于配置路由微处理单元111中内置第二寄存器的工作模式。在具体实施例中，上述第二数据接收单元112包括以太网数据接口和/或无线收发接口；第二寄存器的工作模式为先进先出模式。
作为一个具体实施例，在加密过程中，首先，需要进行加密的明文经有线以太网传输到路由器100中的路由功能模块110的路由微处理单元111中；路由微处理单元111随即使用无线IEEE802.3协议对该明文进行数据帧的分析后通过SPI总线转送到FPGA中的硬件加解密模块120中的加解密模块中进行加密得到相应的密文，再将得到的密文转发给路由微处理单元111；路由微处理单元111通过IEEE802.11MAC协议对其中的数据帧进行封装之后通过无线物理层发送到无线信道之中，经天线辐射到信号覆盖空间；具备无线功能终端(如，智能手机、平板电脑等)就能接收该密文。解密过程为这个反过程，在此不做赘述。
如图6所示，本发明还提供了一种路由器100加密方法，该加密方法应用于上述的具备硬件加解密功能的路由器100，该路由器100加密方法包括以下步骤：
S100路由功能模块110从外界接收需要进行加密的明文，并将明文发送 至硬件加解密模块120。具体来说，在该步骤中，包括：
S101路由功能模块110从外界接收需要进行加密的明文。
S102路由功能模块110对接收到的明文进行报文解析。
S103路由功能模块110对其内置的第二寄存器的工作模式进行配置。
S104路由功能模块110将经过报文解析后的明文、寄存器配置指令以及控制指令发送至硬件加解密模块120。
S110硬件加解密模块120对明文进行加密，并将加密生成的加密数据发送至路由功能模块110。具体来说，在该步骤中，包括以下步骤：
S111硬件加解密模块120接收经过报文解析后的明文、寄存器配置指令以及控制指令。
S112缓存经过报文解析后的明文。
S113硬件加解密模块120根据寄存器配置指令配置其内置的第一寄存器的工作模式。
S114硬件加解密模块120根据控制指令生成随机密钥，并将随机密钥缓存在第一寄存器中。
S115硬件加解密模块120对随机密钥进行扩展生成加密密钥，并将加密密钥进行存储。
S116硬件加解密模块120使用加密密钥对经过报文解析后的明文进行加密生成加密数据，并将加密数据缓存在第一寄存器中。更进一步来说，在该步骤中，具体包括：
S1161获取加密总轮数R1；
S1162初始化当前加密轮数r1，将其初始值设定为1；
S1163判断当前加密轮数r1是否大于加密总轮数R1，若不是，跳转至步骤S1163；若是，跳转至步骤S1166；
S1164使用加密密钥对经过报文解析后的明文进行一轮加密；
S1165将r1＝r1+1生成新的当前加密轮数，跳转至步骤S1163；
S1166加密结束。
S117硬件加解密模块120将加密数据发送至路由功能模块110。
S120路由功能模块110将加密数据经由无线信道发送出去。具体来说，在该步骤中，具体包括以下步骤：
S121路由功能模块110接收加密数据；
S122路由功能模块110对加密数据中的数据帧进行封装；
S123路由功能模块110将封装后的加密数据经由无线信道发送出去。
在一个具体实施例中，以下我们对硬件加解密模块120中加密的过程进行详细描述，在该过程中，第一寄存器中具体包括2个寄存器，分别为寄存器1和寄存器2：
对路由器100进行上电，初始化该路由器100设备，路由功能模块110中的路由微处理单元111将其内置的第二寄存器配置为先进先出模式。
路由器100通过以太网或无线的方式接收需要进行加密的明文，同时路由功能模块110中的路由微处理单元111对接收到的明文进行报文解析，并将经过解析后的明文缓存在第一寄存器中；接着将进行了报文解析的明文发送至硬件加解密模块120中。
硬件加解密模块120中的FPGA处理器121将接收到的明文缓存在第一寄存器(寄存器1)中；同时控制随机数生成单元产生随机密钥，并将其缓存在内置的第一寄存器(寄存器2)中；之后对生成的随机密钥进行扩展生成加密密钥(这个过程中将寄存器2设置为0，将随机密钥送至密钥扩展单元1232中)；接着，硬件加解密模块120中的加解密单元124根据接收到的明文使用加密密钥对其进行加密。
加解密单元124在对其进行加密的过程中，首先得到加密总轮数R1，随后基于该加密总轮数对明文(在这个过程中将寄存器1设置为1，将第一寄存器中存储的明文发送至加解密单元124中)进行一轮一轮的加密，直到加密的轮数达到该加密总轮数R1完成对明文的加密生成加密数据并进行缓存。最后将加密数据反馈回路由微处理单元111中；路由微处理单元111接收到该加密数据之后，对其进行封装再经由无线信道发送出去。具体，在这个实施例中，上述AES算法数据宽度为128bit(比特)，密钥长度为192bit，相对应的加密/解密轮数为12(加密总轮数R1)，即对明文加密12轮得到密文。
如图7所示，本发明还提供了一种路由器100解密方法，应用于上述具备硬件加解密功能的路由器100，路由器100解密方法包括以下步骤：
S200路由功能模块110从外界接收需要进行解密的密文，并将密文发送至硬件加解密模块120。具体来说，与路由器100加密方法类似，在该步骤中，包括以下步骤：
S201路由功能模块110从外界接收需要进行解密的密文。
S202路由功能模块110对接收到的密文进行报文解析。
S203路由功能模块110对其内置的第二寄存器的工作模式进行配置。
S204路由功能模块110将经过报文解析后的密文、寄存器配置指令以及控制指令发送至硬件加解密模块120。
S210硬件加解密模块120对密文进行解密，并将解密生成的解密数据发送至路由功能模块110。具体来说，与路由器100加密方法类似，在该步骤中，包括以下步骤：
S211硬件加解密模块120接收经过报文解析后的密文、寄存器配置指令以及控制指令。
S212缓存经过报文解析后的密文。
S213硬件加解密模块120根据寄存器配置指令配置其内置的第一寄存器。
S214硬件加解密模块120对经过报文解析后的密文的报头进行认证。具体包括：
S2141使用加密该密文的过程中缓存在第一寄存器中的随机密钥对密文的报头进行加密生成第一报头加密信息；
S2142使用加密该密文过程中缓存在第一寄存器中的随机密钥对缓存在第一寄存器中的该密文的报头进行加密生成第二报头加密信息；
S2142比对第一报头加密信息和第二报头加密信息，对密文进行认证；
S2143若认证成功，跳转至步骤S215。
S215硬件加解密模块120根据控制指令生成随机密钥，并将随机密钥缓存在第一寄存器中。
S216硬件加解密模块120对随机密钥进行扩展生成解密密钥，并存储解密密钥。
S217硬件加解密模块120使用解密密钥对经过报文解析后的密文进行解密生成解密数据，并缓存解密数据。具体包括：
S2171获取解密总轮数R2；
S2172初始化当前解密轮数r2，将其初始设定为1；
S2173判断当前解密轮数r2是否大于解密总轮数R2，若不是，跳转至步骤S2173；若是，跳转至步骤S2176；
S2174使用解密密钥对经过报文解析后的密文进行一轮解密；
S2175将r＝r+1生成新的当前解密轮数，并跳转至步骤S1163；
S2176解密结束。
S218硬件解密模块将解密数据发送至路由功能模块110。
S220路由功能模块110将解密数据经由无线信道发送出去。在该步骤中，具体包括以下步骤：
S221路由功能模块110接收解密数据；
S222路由功能模块110对解密数据进行封装；
S223路由功能模块110将封装后的解密数据经由无线信道发送出去。
在一个具体实施例中，以下我们对硬件加解密模块120中解密的过程进行详细描述，在该过程中，第一寄存器中具体包括2个寄存器，分别为寄存器1和寄存器2：
对路由器100进行上电，初始化该路由器100设备，路由功能模块110中的路由微处理单元111将其内置的第二寄存器配置为先进先出模式。
路由器100通过以太网或无线的方式接收需要进行解密的密文，同时路由功能模块110中的路由微处理单元111对接收到的密文进行报文解析，并将经过解析后的密文缓存在第一寄存器中；接着将进行了报文解析的密文发送至硬件加解密模块120中。
硬件加解密模块120中的FPGA处理器121将接收到的密文缓存在第一寄存器(寄存器1)中；且在对该密文进行解密之前首先对该密文的报头进行认 证。在认证的过程中，首先，在使用加密该密文的过程中缓存在第一寄存器(寄存器2)中的随机密钥对密文的报头进行加密生成第一报头加密信息；随后，使用加密该密文过程中缓存在第一寄存器(寄存器2)中的随机密钥对缓存在第一寄存器(寄存器1)中的该密文的报头进行加密生成第二报头加密信息；接着，比对第一报头加密信息和第二报头加密信息，对密文进行认证；若比对成功，则说明认证成功，进入解密过程；相反，若比对失败，则说明认证失败，将该密文进行丢弃处理。
之后，FPGA处理器121控制随机数生成单元产生随机密钥，并将其缓存在内置的第一寄存器(寄存器2)中；之后对生成的随机密钥进行扩展生成解密密钥(这个过程中将第一寄存器(寄存器2)设置为0，将随机密钥送至密钥扩展单元1232中)；接着，硬件加解密模块120中的加解密单元124根据接收到的密文使用解密密钥对其进行解密。
加解密单元124在对其进行解密的过程中，首先得到解密总轮数R2，随后基于该解密总轮数对密文(在这个过程中将第一寄存器(寄存器1)设置为0，将第一寄存器中存储的密文发送至加解密单元124中)进行一轮一轮的解密，直到解密的轮数达到该解密总轮数R2完成对密文的解密生成解密数据并进行缓存。最后将解密数据反馈回路由微处理单元111中；路由微处理单元111接收到该解密数据之后，对其进行封装再经由无线信道发送出去。具体，在这个实施例中，上述AES算法数据宽度为128bit(比特)，密钥长度为192bit，相对应的加密/解密轮数为12(加密总轮数R2)，即对密文解密12轮得到明文。
应当说明的是，上述实施例均可根据需要自由组合。以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (19)

  1. 一种具备硬件加解密功能的路由器，其特征在于，所述路由器中包括相互连接的路由功能模块和基于现场可编程门阵列的硬件加解密模块，所述硬件加解密模块对所述路由功能模块从外界接收的明文进行加密或对路由功能模块从外界接收的密文进行解密，且所述路由功能模块将所述硬件加解密模块加密生成的加密数据或解密生成的解密数据经由无线信道发送出去。
  2. 如权利要求1所述的路由器，其特征在于，所述硬件加解密模块中包括：现场可编程门阵列处理器、第一数据接收单元、密钥生成器、内置于所述现场可编程门阵列处理器的第一寄存器、内置于所述现场可编程门阵列处理器的第一配置单元、加解密单元以及第一数据发送单元，其中，
    所述第一数据接收单元，与所述路由功能模块连接，所述第一数据接收单元用于接收所述路由功能模块发送的需要进行加密的明文或需要进行解密的密文、用于接收所述路由功能模块发送的寄存器配置指令以及用于接收所述路由功能模块发送的控制所述密钥生成器产生密钥的控制指令；
    所述第一配置单元，用于根据所述寄存器配置指令配置所述第一寄存器的工作模式；
    所述密钥生成器，与所述现场可编程门阵列处理器连接，所述密钥生成器在所述现场可编程门阵列处理器的控制下根据所述控制指令生成加密密钥或解密密钥；
    所述加解密单元，分别与所述现场可编程门阵列处理器和所述密钥生成器连接，所述加解密单元在所述现场可编程门阵列处理器的控制下使用所述加密密钥对所述明文进行加密或使用所述解密密钥对所述密文进行解密，并将生成的加密数据或解密数据缓存在所述第一寄存器中；
    所述第一数据发送单元，与所述现场可编程门阵列处理器连接，所述第一数据发送单元在所述现场可编程门阵列处理器的控制下将所述第一寄存器中缓存的所述加密数据或所述解密数据发送至所述路由功能模块。
  3. 如权利要求2所述的路由器，其特征在于，所述密钥生成器中包括：随机数发生单元、密钥扩展单元以及存储单元，其中，
    所述随机数发生单元，与所述现场可编程门阵列处理器连接，所述随机 数发生单元在所述现场可编程门阵列处理器的控制下产生随机密钥，并将所述随机密钥发送至所述第一寄存器中进行缓存；
    所述密钥扩展单元，与所述现场可编程门阵列处理器和所述存储单元连接，所述密钥扩展单元在所述现场可编程门阵列处理器的控制下对所述第一寄存器中缓存的所述随机密钥进行扩展生成加解密密钥，并将所述加解密密钥发送至所述存储单元中进行存储。
  4. 如权利要求2所述的路由器，其特征在于，
    所述第一数据接收单元为一串并转换接口，所述第一数据发送单元为一并串转换接口；所述第一寄存器的工作模式为先进先出模式。
  5. 如权利要求3所述的路由器，其特征在于，
    所述硬件加解密模块中还包括一认证单元，所述认证单元分别与现场可编程门阵列处理器和所述加解密单元连接；
    当所述硬件加解密模块接收到所述路由功能模块发送的需要进行解密的密文时，所述加解密单元使用加密该密文过程中缓存在所述第一寄存器中的随机密钥对所述密文的报头进行加密生成第一报头加密信息；同时所述加解密单元使用加密该密文过程中缓存在所述第一寄存器中的随机密钥对缓存在所述第一寄存器中的该密文的报头进行加密生成第二报头加密信息；所述认证单元将所述第一报头加密信息和所述第二报头加密信息进行比对，实现接收的所述密文的认证。
  6. 如权利要求1-5任意一项所述的路由器，其特征在于，所述硬件加解密模块为基于现场可编程门阵列的高级加密标准硬件加解密模块。
  7. 如权利要求1-5任意一项所述的路由器，其特征在于，所述路由功能模块中包括：路由微处理单元、内置于所述路由微处理器中的第二配置单元、内置在所述路由微处理单元中的第二寄存器、第二数据接收单元以及第二数据发送单元，所述第二数据接收单元、所述第二数据发送单元和所述第二配置单元分别与所述路由微处理单元连接；
    在接收明文或密文的过程中：所述路由功能模块通过所述第二数据接收单元接收外界发送的明文或密文，并将其发送至所述路由微处理单元；所述 路由微处理单元对接收到的所述明文或密文进行报文解析，并将经过报文解析后的明文或密文缓存在所述第二寄存器中，最后将缓存在所述第二寄存器中的经过报文解析后的明文或密文通过所述第二数据发送单元发送至所述硬件加解密模块；
    在发送经过加解密生成的加密数据或解密数据的过程中：所述路由功能模块通过所述第二数据接收单元接收所述硬件加解密模块生成的加密数据或解密数据并进行封装，并将经过封装的加密数据或解密数据缓存在所述第二寄存器中，最后将缓存在所述第二寄存器中的封装后的加密数据或解密数据经由无线信道发送出去；
    所述第二配置单元，用于配置所述路由微处理单元中内置第二寄存器的工作模式。
  8. 如权利要求7所述的路由器，其特征在于，所述第二数据接收单元包括以太网数据接口和/或无线收发接口；所述第二寄存器的工作模式为先进先出模式。
  9. 一种路由器加密方法，其特征在于，所述加密方法应用于如权利要求1所述的具备硬件加解密功能的路由器，所述路由器加密方法包括以下步骤：
    S100路由功能模块从外界接收需要进行加密的明文，并将所述明文发送至所述硬件加解密模块；
    S110所述硬件加解密模块对所述明文进行加密，并将加密生成的加密数据发送至所述路由功能模块；
    S120所述路由功能模块将所述加密数据经由无线信道发送出去。
  10. 如权利要求9所述的路由器加密方法，其特征在于，在步骤S100中，具体包括：
    S101所述路由功能模块从外界接收需要进行加密的明文；
    S102所述路由功能模块对接收到的所述明文进行报文解析；
    S103所述路由功能模块对其内置的第二寄存器的工作模式进行配置；
    S104所述路由功能模块将经过报文解析后的明文、寄存器配置指令以及控制指令发送至所述硬件加解密模块。
  11. 如权利要求10所述的路由器加密方法，其特征在于，在步骤S110中，具体包括以下步骤：
    S111所述硬件加解密模块接收所述经过报文解析后的明文、寄存器配置指令以及控制指令；
    S112缓存所述经过报文解析后的明文；
    S113所述硬件加解密模块根据所述寄存器配置指令配置其内置的第一寄存器的工作模式；
    S114所述硬件加解密模块根据所述控制指令生成随机密钥，并将所述随机密钥缓存在所述第一寄存器中；
    S115所述硬件加解密模块对所述随机密钥进行扩展生成加密密钥，并将所述加密密钥进行存储；
    S116所述硬件加解密模块使用所述加密密钥对所述经过报文解析后的明文进行加密生成加密数据，并将所述加密数据缓存在所述第一寄存器中；
    S117所述硬件加解密模块将所述加密数据发送至所述路由功能模块。
  12. 如权利要求11所述的路由器加密方法，其特征在于，在步骤S116中，具体包括：
    S1161获取加密总轮数R1；
    S1162初始化当前加密轮数r1，将其初始值设定为1；
    S1163判断当前加密轮数r1是否大于加密总轮数R1，若不是，跳转至步骤S1163；若是，跳转至步骤S1166；
    S1164使用所述加密密钥对所述经过报文解析后的明文进行一轮加密；
    S1165将r1＝r1+1生成新的当前加密轮数，跳转至步骤S1163；
    S1166加密结束。
  13. 如权利要求11或12所述的路由器加密方法，其特征在于，在步骤S120中，具体包括以下步骤：
    S121所述路由功能模块接收所述加密数据；
    S122所述路由功能模块对所述加密数据进行封装；
    S123所述路由功能模块将封装后的加密数据经由无线信道发送出去。
  14. 一种路由器解密方法，其特征在于，所述解密方法应用于如权利要求1所述的具备硬件加解密功能的路由器，所述路由器解密方法包括以下步骤：
    S200路由功能模块从外界接收需要进行解密的密文，并将所述密文发送至所述硬件加解密模块；
    S210所述硬件加解密模块对所述密文进行解密，并将解密生成的解密数据发送至所述路由功能模块；
    S220所述路由功能模块将所述解密数据经由无线信道发送出去。
  15. 如权利要求14所述的路由器解密方法，其特征在于，在步骤S200中，具体包括：
    S201路由功能模块从外界接收需要进行解密的密文；
    S202所述路由功能模块对接收到的所述密文进行报文解析；
    S203所述路由功能模块对其内置的第二寄存器的工作模式进行配置；
    S204所述路由功能模块将经过报文解析后的密文、寄存器配置指令以及控制指令发送至所述硬件加解密模块。
  16. 如权利要求15所述的路由器解密方法，其特征在于，在步骤S210中，具体包括以下步骤：
    S211所述硬件加解密模块接收所述经过报文解析后的密文、寄存器配置指令以及控制指令；
    S212缓存所述经过报文解析后的密文；
    S213所述硬件加解密模块根据所述寄存器配置指令配置其内置的第一寄存器；
    S214所述硬件加解密模块对所述经过报文解析后的密文的报头进行认证；
    S215所述硬件加解密模块根据所述控制指令生成随机密钥，并将所述随机密钥缓存在所述第一寄存器中；
    S216所述硬件加解密模块对所述随机密钥进行扩展生成解密密钥，并存储所述解密密钥；
    S217所述硬件加解密模块使用所述解密密钥对所述经过报文解析后的 密文进行解密生成解密数据，并缓存所述解密数据；
    S218所述硬件解密模块将所述解密数据发送至所述路由功能模块。
  17. 如权利要求16所述的路由器解密方法，其特征在于，在步骤S214中具体包括以下步骤：
    S2141使用加密该密文的过程中缓存在第一寄存器中的随机密钥对所述密文的报头进行加密生成第一报头加密信息；
    S2142使用加密该密文过程中缓存在所述第一寄存器中的随机密钥对缓存在所述第一寄存器中的该密文的报头进行加密生成第二报头加密信息；
    S2142比对所述第一报头加密信息和所述第二报头加密信息，对所述密文进行认证；
    S2143若认证成功，跳转至步骤S215。
  18. 如权利要求17所述的路由器解密方法，其特征在于，在步骤S217中，具体包括：
    S2171获取解密总轮数R2；
    S2172初始化当前解密轮数r2，将其初始设定为1；
    S2173判断当前解密轮数r2是否大于解密总轮数R2，若不是，跳转至步骤S2173；若是，跳转至步骤S2176；
    S2174使用所述解密密钥对所述经过报文解析后的密文进行一轮解密；
    S2175将r＝r+1生成新的当前解密轮数，并跳转至步骤S1163；
    S2176解密结束。
  19. 如权利要求17或18所述的路由器解密方法，其特征在于，在步骤S220中，具体包括以下步骤：
    S221所述路由功能模块接收所述解密数据；
    S222所述路由功能模块对所述解密数据进行封装；
    S223所述路由功能模块将封装后的解密数据经由无线信道发送出去。
PCT/CN2016/101401 2015-12-03 2016-09-30 一种具备硬件加解密功能的路由器及其加解密方法 WO2017092504A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510881396.X 2015-12-03
CN201510881396.XA CN105357218B (zh) 2015-12-03 2015-12-03 一种具备硬件加解密功能的路由器及其加解密方法

Publications (1)

Publication Number Publication Date
WO2017092504A1 true WO2017092504A1 (zh) 2017-06-08

Family

ID=55333082

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101401 WO2017092504A1 (zh) 2015-12-03 2016-09-30 一种具备硬件加解密功能的路由器及其加解密方法

Country Status (2)

Country Link
CN (1) CN105357218B (zh)
WO (1) WO2017092504A1 (zh)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110929298A (zh) * 2019-11-20 2020-03-27 天津津航计算技术研究所 多接口lrm加密板卡
CN111814167A (zh) * 2020-07-14 2020-10-23 北京九维数安科技有限公司 数据加解密处理系统及方法
CN113626838A (zh) * 2021-07-19 2021-11-09 杭州加速科技有限公司 一种基于pcie的分块加密存储方法和装置
CN113872975A (zh) * 2021-09-29 2021-12-31 中国人民解放军火箭军工程大学 一种信息加密传输装置及方法
CN114978676A (zh) * 2022-05-20 2022-08-30 江苏新质信息科技有限公司 基于FPGA、eBPF协同的数据包加解密方法及系统
CN115242530A (zh) * 2022-07-27 2022-10-25 常州星宇车灯股份有限公司 基于国密算法的车载安全通信系统、方法及汽车

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105357218B (zh) * 2015-12-03 2018-07-24 上海斐讯数据通信技术有限公司 一种具备硬件加解密功能的路由器及其加解密方法
CN109067517B (zh) * 2018-06-22 2021-07-09 成都卫士通信息产业股份有限公司 加密、解密装置、加密、解密方法和隐藏密钥的通信方法
CN111400700B (zh) * 2020-03-10 2023-07-21 深圳市三旺通信股份有限公司 交换机的加密方法、装置、设备及计算机可读存储介质
CN112256622B (zh) * 2020-10-10 2022-12-02 天津大学 一种基于可编程逻辑阵列实现安全传输的方法
CN114499821A (zh) * 2020-11-12 2022-05-13 华为技术有限公司 加解密系统、光模块和相关装置、系统
CN112787820B (zh) * 2021-01-02 2022-02-11 浙江大学 一种适用于硬件实现的轻量级认证加密解密实现方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN2402065Y (zh) * 2000-01-11 2000-10-18 北京华正天网信息安全技术有限公司 路由器的安全加密模件
CN1373461A (zh) * 2001-02-28 2002-10-09 伊诺瓦科技股份有限公司 应用于数据储存的加解密装置
CN1622517A (zh) * 2003-11-27 2005-06-01 上海安创信息科技有限公司 一种嵌入式信息安全平台
CN101754198A (zh) * 2008-12-12 2010-06-23 北京中电华大电子设计有限责任公司 基于wapi硬加密芯片的无线路由器
CN105357218A (zh) * 2015-12-03 2016-02-24 上海斐讯数据通信技术有限公司 一种具备硬件加解密功能的路由器及其加解密方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6078736A (en) * 1997-08-28 2000-06-20 Xilinx, Inc. Method of designing FPGAs for dynamically reconfigurable computing
CN2565211Y (zh) * 2002-09-09 2003-08-06 北京五达捷讯科技有限责任公司 安全路由器
CN102223228A (zh) * 2011-05-11 2011-10-19 北京航空航天大学 基于fpga的aes加密芯片设计方法及嵌入式加密系统
CN102664729B (zh) * 2012-04-28 2014-12-31 中山大学 一种基于fpga的aes加解密网络通讯装置及其实现方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN2402065Y (zh) * 2000-01-11 2000-10-18 北京华正天网信息安全技术有限公司 路由器的安全加密模件
CN1373461A (zh) * 2001-02-28 2002-10-09 伊诺瓦科技股份有限公司 应用于数据储存的加解密装置
CN1622517A (zh) * 2003-11-27 2005-06-01 上海安创信息科技有限公司 一种嵌入式信息安全平台
CN101754198A (zh) * 2008-12-12 2010-06-23 北京中电华大电子设计有限责任公司 基于wapi硬加密芯片的无线路由器
CN105357218A (zh) * 2015-12-03 2016-02-24 上海斐讯数据通信技术有限公司 一种具备硬件加解密功能的路由器及其加解密方法

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110929298A (zh) * 2019-11-20 2020-03-27 天津津航计算技术研究所 多接口lrm加密板卡
CN111814167A (zh) * 2020-07-14 2020-10-23 北京九维数安科技有限公司 数据加解密处理系统及方法
CN111814167B (zh) * 2020-07-14 2024-02-09 北京九维数安科技有限公司 数据加解密处理系统及方法
CN113626838A (zh) * 2021-07-19 2021-11-09 杭州加速科技有限公司 一种基于pcie的分块加密存储方法和装置
CN113872975A (zh) * 2021-09-29 2021-12-31 中国人民解放军火箭军工程大学 一种信息加密传输装置及方法
CN113872975B (zh) * 2021-09-29 2023-08-18 中国人民解放军火箭军工程大学 一种信息加密传输装置及方法
CN114978676A (zh) * 2022-05-20 2022-08-30 江苏新质信息科技有限公司 基于FPGA、eBPF协同的数据包加解密方法及系统
CN114978676B (zh) * 2022-05-20 2024-03-12 江苏新质信息科技有限公司 基于FPGA、eBPF协同的数据包加解密方法及系统
CN115242530A (zh) * 2022-07-27 2022-10-25 常州星宇车灯股份有限公司 基于国密算法的车载安全通信系统、方法及汽车
CN115242530B (zh) * 2022-07-27 2023-10-13 常州星宇车灯股份有限公司 基于国密算法的车载安全通信系统、方法及汽车

Also Published As

Publication number Publication date
CN105357218B (zh) 2018-07-24
CN105357218A (zh) 2016-02-24

Similar Documents

Publication Publication Date Title
WO2017092504A1 (zh) 一种具备硬件加解密功能的路由器及其加解密方法
US9667601B2 (en) Proxy SSL handoff via mid-stream renegotiation
US8769257B2 (en) Method and apparatus for extending transport layer security protocol for power-efficient wireless security processing
JP2023116573A (ja) クライアント－クラウドまたはリモートサーバーの安全なデータまたはファイル・オブジェクト暗号化ゲートウェイ
US8538023B2 (en) Methods and apparatuses for administrator-driven profile update
Randhawa et al. Energy efficient cross-layer approach for object security of CoAP for IoT devices
CN107483383B (zh) 一种数据处理方法、终端、后台服务器及存储介质
JP2018525891A5 (zh)
Hayajneh et al. An enhanced WLAN security system with FPGA implementation for multimedia applications
JP2018537912A5 (zh)
US9872175B2 (en) Packet processing method, apparatus, and system
KR101452124B1 (ko) 사물간 통신 네트워크에서 암호화 기반 기기 인증 및 세션키 생성 방법
Kothmayr et al. Poster: Securing the internet of things with DTLS
Fu et al. A secure SDN based multi-RANs architecture for future 5G networks
US20180176230A1 (en) Data packet transmission method, apparatus, and system, and node device
US11652910B2 (en) Data transmission method, device, and system
WO2018132796A1 (en) Physical gate based preamble obfuscation for securing wireless communication
KR101707602B1 (ko) 해시 트리 기반 보안 메시지 인증 방법 및 이를 위한 장치
Kushwaha et al. Selective encryption using natural language processing for text data in mobile ad hoc network
CN106506461A (zh) 一种基于scada系统的安全dnp协议的实现方法
CN110650016B (zh) 一种实现交直流控制保护系统网络数据安全的方法
Alaoui New experimental results for AES-CCMP acceleration on cyclone-ii FPGA
Carnevale et al. A hardware accelerator for the IEEE 802.1 X-2010 key hierarchy in automotive applications
Ahmad et al. A survey of high performance cryptography algorithms for WiMAX applications using SDR
Somaiya et al. WLAN security and efficiency issues based on encryption techniques

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16869815

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16869815

Country of ref document: EP

Kind code of ref document: A1